TACTIC: DEFENSE EVASION
Masquerading (T1036): Real Cases
MITRE Definition ↗ Adversaries manipulate features of their artifacts to make them appear legitimate or benign.
Key Facts
Technique ID
T1036
Defense Evasion
Mapped Cases
1
Primary sources
Related Laws
0
Criminal statutes
- ATT&CK Technique Identifier: T1036.
- Tactical Phase: Defense Evasion.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
alleged 2020-12-13
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
Primary Source Evidence Excerpt: CISA Advisory AA20-352A ¶ 21
"The TEARDROP memory-only dropper masqueraded as legitimate Windows system services to maintain persistent memory presence."
U.S. District Court for the Southern District of New York · SEC CIK 0001739942
View full case dossier →